VBA 解析 XML

Question

我在解析 XML 文件以导入 MS Access 数据库时遇到问题。到目前为止，我有一个 MS Access 表单，允许选择 XML 文件然后运行解析功能。

Private Function LoadXML(XMLfile)

我对 XML 和在 VBA 中处理它的经验有限。 XML 文件由从移动设备中提取数据的取证分析软件生成。 我是一名治安官，在警察局工作，官方需要和使用这些数据。

我需要从 XML 文件中提取数据，以便能够比较其他设备上的信息。似乎我需要一个函数来从“”下的每个节点逐个字段地获取所有数据其他“”可能在节点内有更多或更少的字段。我不知道在哪里开始。前几个函数成功定位了 CaseNumber 等

这是软件生成的 XML 示例：

<?xml version="1.0" encoding="utf-8"?>
<project id="123REDACTED456" name="Apple iOS Full File system_2023-01-18_Report" reportVersion="7.48" licenseID="123REDACTED456" containsGarbage="False" extractionType="Legacy" NodeCount="0" ModelCount="1277" xmlns="http://pa.cellebrite.com/report/2.0">
  <sourceExtractions>
    <extractionInfo id="0" name="Legacy" isCustomName="False" type="Legacy" deviceName="123REDACTED456" fullName="Apple iOS Full File system" index="0" IsPartialData="False" IsStoppedByUser="False" IsSelectiveExtraction="False" />
  </sourceExtractions>
  <caseInformation>
    <field name="Examiner name" isSystem="True" isRequired="True" fieldType="ExaminerName" multipleLines="False">123REDACTED456</field>
    <field name="Location" isSystem="True" isRequired="False" fieldType="Location" multipleLines="False">123REDACTED456</field>
    <field name="Case number" isSystem="True" isRequired="False" fieldType="CaseNumber" multipleLines="False">123REDACTED456</field>
    <field name="Evidence number" isSystem="True" isRequired="False" fieldType="EvidenceNumber" multipleLines="False">123REDACTED456</field>
    <field name="Department" isSystem="True" isRequired="False" fieldType="Department" multipleLines="False">123REDACTED456</field>
    <field name="Investigator" isSystem="True" isRequired="False" fieldType="Investigator" multipleLines="False">123REDACTED456</field>
  </caseInformation>
  <metadata section="Additional Fields">
    <item name="DeviceInfoCreationTime" systemtype="System.String"><![CDATA[01/03/2023 17:15:22]]></item>
    <item name="UFED_PA_Version" systemtype="System.String"><![CDATA[7.59.1.16]]></item>
  </metadata>
  <metadata section="Extraction Data">
    <item name="DeviceInfoSelectedManufacturer" sourceExtraction="0" systemtype="System.String"><![CDATA[Apple]]></item>
    <item name="DeviceInfoSelectedDeviceName" sourceExtraction="0" systemtype="System.String"><![CDATA[APPLE_IOS_FULL_FILE_SYSTEM]]></item>
    <item name="Time zone settings (ID)" sourceExtraction="0" systemtype="System.String"><![CDATA[_America/Los_Angeles]]></item>
    <item name="Time zone settings (ID)" systemtype="System.String"><![CDATA[_America/Los_Angeles]]></item>
  </metadata>
  <images />
  <HashSetsInfo />
  <MalwareScanner ScanPerformed="False" />
  <taggedFiles>
    <file fs="00008030-001A3031020B802E_files_full.zip" fsid="123REDACTED456" path="123REDACTED456" size="4738" id="123REDACTED456" extractionId="0" deleted="Intact" embedded="false" isrelated="False" labels="16" decodedBy="System" source_index="25875">
      <accessInfo>
        <timestamp name="CreationTime" format="TimeStampKnown" formattedTimestamp="2021-09-23T01:07:46+00:00">2021-09-23T01:07:46.000+00:00</timestamp>
        <timestamp name="ModifyTime" format="TimeStampKnown" formattedTimestamp="2021-10-05T17:33:16+00:00">2021-10-05T17:33:16.000+00:00</timestamp>
        <timestamp name="AccessTime" format="TimeStampKnown" formattedTimestamp="2021-10-05T17:33:16+00:00">2021-10-05T17:33:16.000+00:00</timestamp>
      </accessInfo>
      <metadata section="File">
        <item name="Local Path" systemtype="System.String"><![CDATA[123REDACTED456]]></item>
        <item name="SHA256" systemtype="System.String"><![CDATA[]]></item>
        <item name="MD5" systemtype="System.String"><![CDATA[123REDACTED456]]></item>
        <item name="Tags" systemtype="System.String"><![CDATA[Image]]></item>
      </metadata>
      <metadata section="MetaData">
        <item name="Uid" systemtype="System.String"><![CDATA[501]]></item>
        <item name="Gid" systemtype="System.String"><![CDATA[501]]></item>
        <item name="CoreFileSystemFileSystemNodeFileDataOffsetName" group="CoreFileSystemFileSystemNodeFileOffsetsCategory" systemtype="System.String"><![CDATA[0x537E26A48]]></item>
        <item name="CoreFileSystemFileSystemNodeCreationTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="PA.Data.Utils.TimeStamp">2021-09-22T18:07:46.000-07:00</item>
        <item name="CoreFileSystemFileSystemNodeModifyTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="PA.Data.Utils.TimeStamp">2021-10-05T10:33:16.000-07:00</item>
        <item name="CoreFileSystemFileSystemNodeLastAccessTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="PA.Data.Utils.TimeStamp">2021-10-05T10:33:16.000-07:00</item>
        <item name="CoreFileSystemFileSystemNodeDeletedTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
        <item name="CoreFileSystemFileSystemNodeChangeTime" group="CoreFileSystemFileSystemNodeDateTime" systemtype="System.String"><![CDATA[]]></item>
        <item name="ReportTemplateFileSize" systemtype="System.String"><![CDATA[4738 Bytes]]></item>
        <item name="CoreFileSystemFileSystemNodeFileChunks" systemtype="System.String"><![CDATA[1]]></item>
      </metadata>
      <sourcemodels>
        <ownerid direction="Unknown" type="Contact"><![CDATA[123REDACTED456]]></ownerid>
      </sourcemodels>
      <jumptargets name="">
        <targetid ismodel="true"><![CDATA[123REDACTED456]]></targetid>
      </jumptargets>
    </file>
  </taggedFiles>
  <decodedData>
    <modelType type="Contact">
      <model type="Contact" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41272" extractionId="0">
        <field name="UserMapping" type="DecodingSourceOptions">
          <value type="DecodingSourceOptions"><![CDATA[Decoding]]></value>
        </field>
        <field name="Source" type="String">
          <value type="String"><![CDATA[Snapchat]]></value>
        </field>
        <field name="Name" type="String">
          <value type="String"><![CDATA[123REDACTED456]]></value>
        </field>
        <multiModelField name="Photos" type="ContactPhoto">
          <model type="ContactPhoto" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41273" extractionId="0">
            <nodeField name="PhotoNode">
              <id name="123REDACTED456">123REDACTED456</id>
            </nodeField>
            <field name="contactphoto_extracted_path" type="String">
              <value type="String"><![CDATA[123REDACTED456]]></value>
            </field>
          </model>
        </multiModelField>
        <multiModelField name="Entries" type="ContactEntry">
          <model type="UserID" id="7afd6570-45a7-445e-89a3-c4305dab54b0" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41278" extractionId="0">
            <field name="Category" type="String">
              <value type="String"><![CDATA[User ID]]></value>
            </field>
            <field name="Value" type="String">
              <value type="String"><![CDATA[123REDACTED456]]></value>
            </field>
            <field name="Domain" type="String">
              <value type="String"><![CDATA[User ID]]></value>
            </field>
          </model>
          <model type="UserID" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41279" extractionId="0">
            <field name="Category" type="String">
              <value type="String"><![CDATA[Username]]></value>
            </field>
            <field name="Value" type="String">
              <value type="String"><![CDATA[123REDACTED456]]></value>
            </field>
            <field name="Domain" type="String">
              <value type="String"><![CDATA[User ID]]></value>
            </field>
          </model>
        </multiModelField>
        <field name="Group" type="String">
          <empty />
        </field>
        <field name="Type" type="ContactType">
          <value type="ContactType"><![CDATA[Friend]]></value>
        </field>
        <field name="Account" type="String">
          <value type="String"><![CDATA[123REDACTED456]]></value>
        </field>
        <multiField name="InteractionStatuses" type="ContactType">
          <value type="ContactType"><![CDATA[Friend]]></value>
          <value type="ContactType"><![CDATA[ChatParticipant]]></value>
        </multiField>
        <jumptargets name="">
          <targetid ismodel="false"><![CDATA[123REDACTED456]]></targetid>
        </jumptargets>
      </model>
    </modelType>
    <modelType type="Contact">
      <model type="Contact" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41272" extractionId="0">
        <field name="UserMapping" type="DecodingSourceOptions">
          <value type="DecodingSourceOptions"><![CDATA[Decoding]]></value>
        </field>
        <field name="Source" type="String">
          <value type="String"><![CDATA[Snapchat]]></value>
        </field>
        <field name="Name" type="String">
          <value type="String"><![CDATA[123REDACTED456]]></value>
        </field>
        <multiModelField name="Photos" type="ContactPhoto">
          <model type="ContactPhoto" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41273" extractionId="0">
            <nodeField name="PhotoNode">
              <id name="123REDACTED456">123REDACTED456</id>
            </nodeField>
            <field name="contactphoto_extracted_path" type="String">
              <value type="String"><![CDATA[123REDACTED456]]></value>
            </field>
          </model>
        </multiModelField>
        <multiModelField name="Entries" type="ContactEntry">
          <model type="UserID" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41278" extractionId="0">
            <field name="Category" type="String">
              <value type="String"><![CDATA[User ID]]></value>
            </field>
            <field name="Value" type="String">
              <value type="String"><![CDATA[123REDACTED456]]></value>
            </field>
            <field name="Domain" type="String">
              <value type="String"><![CDATA[User ID]]></value>
            </field>
          </model>
          <model type="UserID" id="123REDACTED456" deleted_state="Intact" decoding_confidence="High" isrelated="False" source_index="41279" extractionId="0">
            <field name="Category" type="String">
              <value type="String"><![CDATA[Username]]></value>
            </field>
            <field name="Value" type="String">
              <value type="String"><![CDATA[123REDACTED456]]></value>
            </field>
            <field name="Domain" type="String">
              <value type="String"><![CDATA[User ID]]></value>
            </field>
          </model>
        </multiModelField>
        <field name="Group" type="String">
          <empty />
        </field>
        <field name="Type" type="ContactType">
          <value type="ContactType"><![CDATA[Friend]]></value>
        </field>
        <field name="Account" type="String">
          <value type="String"><![CDATA[123REDACTED456]]></value>
        </field>
        <multiField name="InteractionStatuses" type="ContactType">
          <value type="ContactType"><![CDATA[Friend]]></value>
          <value type="ContactType"><![CDATA[ChatParticipant]]></value>
        </multiField>
        <jumptargets name="">
          <targetid ismodel="false"><![CDATA[123REDACTED456]]></targetid>
        </jumptargets>
      </model>
    </modelType>
  </decodedData>
  <carvedFiles />
  <infectedFiles />
  <extraInfos />
  <projectConfigurations>
    <timeZoneConfigurations enableDaylightSavings="True" enableAutomaticallyConvertToUTC="False" selectedTimeZone="_America/Los_Angeles" />
  </projectConfigurations>
</project>

这是我到目前为止创建的代码示例：

Private Function LoadXML(XMLfile)
Me.Text4.Value = Null
Me.Text6.Value = Null
Dim xmlTopLevelNode, NodeA, NodeB, NodeC, NodeD, NodeE As MSXML2.IXMLDOMNode
Dim xmlDoc As New MSXML2.DOMDocument60
If xmlDoc.Load(XMLfile) Then
    For Each xmlTopLevelNode In xmlDoc.childNodes
        If xmlTopLevelNode.nodeName = "project" Then
            ' Find Extraction Method
            For Each NodeA In xmlTopLevelNode.childNodes
                If NodeA.nodeName = "sourceExtractions" Then
                    For Each NodeB In NodeA.childNodes
                        For Each NodeC In NodeB.Attributes
                            If NodeC.nodeName = "deviceName" Then
                                ' MsgBox "Extraction Method: " & NodeC.nodeTypedValue
                            End If
                        Next
                    Next
                End If
            Next
            ''''''''''''''''''
            ' Find Case Number
            For Each NodeA In xmlTopLevelNode.childNodes
                If NodeA.nodeName = "caseInformation" Then
                    For Each NodeB In NodeA.childNodes
                        For Each NodeC In NodeB.Attributes
                            If NodeC.nodeTypedValue = "CaseNumber" Then
                                ' MsgBox "Case #: " & NodeB.Text
                            End If
                        Next
                    Next
                End If
            Next
            ''''''''''''''''''
            ' Find DeviceInfoSelectedManufacturer
            For Each NodeA In xmlTopLevelNode.childNodes
                If NodeA.nodeName = "metadata" Then
                    For Each NodeB In NodeA.childNodes
                        For Each NodeC In NodeB.Attributes
                            If NodeC.nodeTypedValue = "DeviceInfoSelectedManufacturer" Then
                                ' MsgBox "DeviceInfoSelectedManufacturer: " & NodeB.Text
                            End If
                        Next
                    Next
                End If
            Next
            ''''''''''''''''''
            ' Find DeviceInfoSelectedDeviceName
            For Each NodeA In xmlTopLevelNode.childNodes
                If NodeA.nodeName = "metadata" Then
                    For Each NodeB In NodeA.childNodes
                        For Each NodeC In NodeB.Attributes
                            If NodeC.nodeTypedValue = "DeviceInfoSelectedDeviceName" Then
                                ' MsgBox "DeviceInfoSelectedDeviceName: " & NodeB.Text
                            End If
                        Next
                    Next
                End If
            Next
            ''''''''''''''''''

            ' Find decodedData
            For Each NodeA In xmlTopLevelNode.childNodes
                If NodeA.nodeName = "decodedData" Then
                    For Each NodeB In NodeA.childNodes
                        Me.Text6.Value = Me.Text6.Value & vbNewLine & vbNewLine & NodeB.Text
                    Next
                End If
            Next
            ''''''''''''''''''
        End If
    Next
End If
End Function